Before an endpoint gains access to corporate enterprise network infrastructure and resources, it is increasingly becoming necessary to determine that the endpoint has undergone host security checks and audits to verify that it meets corporate information technology policies. Examples of such checks include, without limitation, verifying that the anti-virus software on the endpoint is up to date, that the latest operating system patches have been installed and that no malicious software is executing on the endpoint. Performing these checks minimizes the infection of other connected corporate assets by a compromised endpoint.
Conventional solutions typically deploy software to collect data and evidence from an endpoint. The collected data is presented to an access infrastructure or other security gateway, which then determines what the endpoint may access. A problem with these approaches is that they typically rely on the assumption that the data from the endpoint has not been corrupted or compromised by a malicious attack, such as a man-in-the-middle attack. Corrupted endpoints can “spoof” endpoint evidence collection and report a favorable result even though the endpoint may actually be in violation of corporate policies. Additionally, a large number of corporate attacks come from trusted users, for a variety of social reasons. These attacks exploit solutions that rely on compliant end users by reporting false evidence. This creates information technology threats and creates a false sense of security.